code-context-control 2.67.0__tar.gz → 2.71.0__tar.gz

{code_context_control-2.67.0/code_context_control.egg-info → code_context_control-2.71.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: code-context-control
-Version: 2.67.0
+Version: 2.71.0
 Summary: Local MCP code-intelligence for AI coding tools: surgical search/read/edit, agent-config version history, path-level access + masking guards, and a multi-project hub.
 Author-email: Dimitri Tselenchuk <dtselenc@gmail.com>
 License-Expression: Apache-2.0
@@ -369,6 +369,8 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.
 - **API keys** for third-party providers are read from the environment and never persisted by C3.

{code_context_control-2.67.0 → code_context_control-2.71.0}/README.md

@@ -306,6 +306,8 @@ C3 also records real per-tool usage to `.c3/tool_telemetry.jsonl`, so estimates
 ## Security & privacy
 
 - **All web servers bind `127.0.0.1` by default** and are guarded against browser-based attacks even on loopback — a Host-header allowlist (defeats DNS rebinding) plus an Origin/Referer check on every request (defeats cross-origin CSRF), with scoped, non-wildcard CORS. There is still **no user authentication**, so do not expose these servers to an untrusted network without auth/TLS in front. Binding to a non-loopback interface is opt-in and warned at startup. *(Hardening added in v2.33.0.)*
+- **Mobile gateway (`/api/mobile/*`)** — the Oracle exposes a companion-app surface for the C3 mobile app: merged cross-project feed, project overview, PM board read/write, digest, notification ack, plus the security surface (credential vault, Access Guard rules and masks, tool discipline). Unlike the legacy Oracle GETs it requires the **Discovery Bearer token on every method, GETs included**, validates every project path against the registry, and audits every write to the project's activity log and edit ledger. Pair the app from Oracle Settings → *Mobile app* (QR code carrying URL + token). Remote reachability is the same recipe as the Discovery API: set `bind_host` to the Tailscale/LAN interface IP (avoid `0.0.0.0`) and list that address in `allowed_hosts`, both in `~/.c3/oracle/config.json`. Disable the whole surface with `"mobile_api_enabled": false`, or any subsystem with `mobile_credentials_enabled` / `mobile_access_enabled` / their `_write` twins.
+- **The mobile gateway never returns a credential value.** It has no reveal route by design: entries cross the wire through an allowlist serializer, and a value can only be identified by its length and an on-demand fingerprint. Two further levers ship **off** — `mobile_creds_agent_readable_raise` (raising `agent_readable` from the phone) and `mobile_access_global_scope` (machine-wide access rules) — because each exceeds what a leaked Bearer token could otherwise reach. Deliberately absent from the surface: bulk `.env` import, denial-counter clearing, `set_builtin_disabled`, and the raw-content access preview.
 - **No telemetry by default.** The OSS package collects nothing. Opt-in Sentry crash reporting requires the `[telemetry]` extra plus both `SENTRY_DSN` and `C3_TELEMETRY_OPT_IN=1`; even then request bodies, local variables, and prompts are stripped.
 - **LLM memory distillation is local-first.** Cloud distillation (v2.51.0) is off by default and opt-in per project.
 - **API keys** for third-party providers are read from the environment and never persisted by C3.

{code_context_control-2.67.0 → code_context_control-2.71.0}/cli/c3.py

@@ -92,7 +92,7 @@ console = Console() if HAS_RICH else None
 # Config
 CONFIG_DIR = ".c3"
 CONFIG_FILE = ".c3/config.json"
-__version__ = "2.67.0"
+__version__ = "2.71.0"
 
 
 def _compress_file_cli(compressor, path, mode="smart", **kw):
@@ -261,6 +261,7 @@ _C3_MCP_ALLOW = [
     "mcp__c3__c3_bitbucket",
     "mcp__c3__c3_jira", "mcp__c3__c3_credentials",
     "mcp__c3__c3_project", "mcp__c3__c3_task", "mcp__c3__c3_artifacts",
+    "mcp__c3__c3_override",
 ]
 
 # Obsolete MCP tool names from earlier C3 versions. `c3 permissions clean`
@@ -6209,6 +6210,299 @@ def _enforce_audit(result: dict, project_path: str) -> None:
         pass
 
 
+_OVERRIDE_DEFAULT_TOOL = {"read": "Read", "write": "Edit"}
+
+
+def cmd_override(args):
+    """`c3 override` — Override Requests: allow one blocked call, once.
+
+    The human half of docs/override-requests.md. Every verb here mints or
+    inspects a *grant*; none of them edits policy. That separation is the
+    entire point of the feature: today the only way to unblock an agent is to
+    weaken a rule permanently, and a guard that spends its life in `advisory`
+    is not a guard.
+
+    No agent surface reaches this command, and no approval here can touch the
+    'never' rows of spec §2 — the credential vault, Tier-0 absolute denies, or
+    the catastrophic shell blocks.
+    """
+    sub = getattr(args, "override_cmd", None)
+    if not sub:
+        print("Usage: c3 override <policy|grant|list|revoke|check|sweep> ...")
+        print("       c3 override policy    # what is escalatable right now")
+        return
+
+    from services import override_grants as og
+    from services import override_policy as opol
+
+    project_path = str(Path(getattr(args, "project_path", ".") or ".").resolve())
+    policy = opol.resolve(project_path)
+    for warn in policy.warnings:
+        print(f"  [warn] {warn}")
+
+    if sub == "policy":
+        _override_show(policy, project_path, opol)
+    elif sub == "grant":
+        _override_grant(args, policy, project_path, og, opol)
+    elif sub == "list":
+        _override_list(args, project_path, og)
+    elif sub == "check":
+        _override_check(args, policy, project_path, og, opol)
+    elif sub == "revoke":
+        gid = getattr(args, "grant_id", "")
+        print("  Revoked." if og.revoke(project_path, gid)
+              else f"  No live grant with id '{gid}'.")
+    elif sub == "sweep":
+        print(f"  Dropped {og.sweep_expired(project_path)} expired/spent grant(s).")
+    elif sub == "requests":
+        _override_requests(args, project_path)
+    elif sub in ("approve", "deny"):
+        _override_decide(args, sub, project_path)
+
+
+def _override_requests(args, project_path: str) -> None:
+    from services import override_requests as orq
+
+    rows = orq.list_requests(
+        project_path="" if getattr(args, "all_projects", False) else project_path,
+        status=getattr(args, "status", "") or "")
+    print_header("Override requests")
+    if not rows:
+        print("  (none)")
+        return
+    for r in rows:
+        note = f"  note: {r['decision_note']}" if r.get("decision_note") else ""
+        print(f"  {r['id']}  {r['status']:<9} {r['tool']} {r['op']} {r['path']}")
+        print(f"  {'':18s} rule {r['rule']} ({r['rule_class']}) · session "
+              f"{r['session_id']} · expires {r['expires_at']}{note}")
+        if r.get("justification"):
+            print(f"  {'':18s} the agent wrote: \"{r['justification']}\"")
+            print(f"  {'':18s} (untrusted — it may be repeating text it read "
+                  f"from a file)")
+    print("\n  Approve: c3 override approve <id>   Refuse: c3 override deny <id>")
+
+
+def _override_decide(args, decision: str, project_path: str) -> None:
+    from services import override_requests as orq
+
+    try:
+        row = orq.decide(getattr(args, "request_id", ""), decision,
+                         uses=getattr(args, "uses", None),
+                         ttl_s=getattr(args, "ttl_s", None),
+                         note=getattr(args, "note", "") or "",
+                         decided_by="cli",
+                         confirm=getattr(args, "confirm", None))
+    except orq.OverrideError as exc:
+        print(f"  {exc}")
+        return
+    except ValueError as exc:
+        print(f"  Error: {exc}")
+        return
+
+    if decision == "deny":
+        print(f"  Denied {row['id']}. The block stands.")
+        return
+    print_header("Override approved")
+    print(f"  Request : {row['id']}   Grant: {row.get('grant_id', '?')}")
+    print(f"  Allows  : {row['tool']} {row['op']} on {row['path']}")
+    print(f"  Session : {row['session_id']}")
+    print(f"\n  The rule {row['rule']} is still in force. One retry of this "
+          "exact call, in")
+    print("  that session, on that exact path — nothing else.")
+
+
+def _override_show(policy, project_path: str, opol) -> None:
+    print_header("Override Requests")
+    state = "on" if policy.enabled else "off"
+    print(f"  Enabled : {state}   (channel: {policy.channel})")
+    print(f"  Project : {project_path}")
+    print("\n  Escalatable layers:")
+    for key in opol.LAYER_KEYS:
+        on = policy.escalatable(key)
+        mark = "*" if on else " "
+        extra = "  (approval needs the rule typed by hand)" \
+            if key in opol.TYPED_CONFIRM_LAYERS else ""
+        print(f"   {mark} {key:18s} {'yes' if on else 'no':3s}{extra}")
+    print("\n  Limits:")
+    print(f"    grant TTL   : <= {policy.max_ttl_s}s (hard ceiling "
+          f"{opol.HARD_MAX_TTL_S}s)")
+    print(f"    uses        : {policy.default_uses} "
+          f"(session grants: {'allowed' if policy.allow_session_grants else 'off'})")
+    print(f"    request TTL : {policy.request_ttl_s}s")
+    print(f"    rate        : {policy.max_pending_per_session} pending/session, "
+          f"{policy.max_requests_per_hour}/hour")
+    if policy.corrupt_scopes:
+        print(f"\n  FAILING CLOSED — corrupt scope(s): "
+              f"{', '.join(policy.corrupt_scopes)}")
+    print("\n  Never escalatable, at any setting: the credential vault, "
+          ".c3/secrets.enc,")
+    print("  .c3/cred_state.json, the dispatcher fail-closed deny, and the "
+          "catastrophic")
+    print("  shell blocks. Policy lives in .c3/config.json 'override' "
+          "(human-edited).")
+
+
+def _override_identify(args, project_path: str, opol):
+    """(gate, layer_key, rule, tool, op, error) for the call being approved.
+
+    Derived from the denial the path ACTUALLY produces, not from what the
+    caller claims: a grant whose rule string does not match the rule that
+    denies would never match at consume time, and a silently-useless grant is
+    worse than a refusal.
+    """
+    op = getattr(args, "op", "read") or "read"
+    tool = getattr(args, "tool", None) or _OVERRIDE_DEFAULT_TOOL[op]
+    layer = getattr(args, "layer", None)
+    target = getattr(args, "target", "")
+
+    if layer == "discipline":
+        return (opol.GATE_DISCIPLINE, opol.LAYER_DISCIPLINE,
+                opol.RULE_DISCIPLINE, tool, "write", None)
+    if layer == "shell":
+        return (opol.GATE_SHELL, opol.LAYER_SHELL_WARN,
+                opol.RULE_SHELL_WARN, tool, op, None)
+
+    from services import access_guard as ag
+    denial = ag.check(target, op, project_path)
+    if denial is None:
+        return (None, None, None, tool, op,
+                f"`{target}` is not blocked for {op} — nothing to approve.")
+    layer_key = opol.rule_class_for_denial(denial)
+    if layer_key is None:
+        return (None, None, None, tool, op,
+                f"{opol.TAG_NOT_ESCALATABLE} `{denial.rule}` can never be "
+                f"overridden — no config value and no approval reaches it.")
+    gate = opol.GATE_FOR_LAYER_KEY[layer_key]
+    if layer and layer != gate:
+        return (None, None, None, tool, op,
+                f"--layer {layer} does not match the layer that denied "
+                f"({gate}, rule `{denial.rule}`).")
+    return gate, layer_key, denial.rule, tool, op, None
+
+
+def _override_grant(args, policy, project_path: str, og, opol) -> None:
+    gate, layer_key, rule, tool, op, err = _override_identify(
+        args, project_path, opol)
+    if err:
+        print(f"  {err}")
+        return
+    if not policy.enabled:
+        print("  Overrides are disabled for this project.")
+        print("  Enable by hand in .c3/config.json — the 'override' section, "
+              "\"enabled\": true,")
+        print(f"  plus \"layers\": {{\"{layer_key}\": true}}. Nothing is "
+              "escalatable by default.")
+        return
+    if not policy.escalatable(layer_key):
+        print(f"  The '{layer_key}' layer is not escalatable "
+              f"(override.layers.{layer_key} is false).")
+        print("  Opt in per layer, deliberately — that is the point of the "
+              "default.")
+        return
+    if (layer_key in opol.TYPED_CONFIRM_LAYERS
+            and getattr(args, "confirm", None) != rule):
+        print(f"  This approves ONE call against an {layer_key} rule "
+              f"({rule}).")
+        print(f"  Retype the rule to confirm:  --confirm '{rule}'")
+        return
+    try:
+        grant = og.mint(project_path, session_id=getattr(args, "session_id", ""),
+                        layer=gate, rule=rule, tool=tool, op=op,
+                        path=getattr(args, "target", ""),
+                        ttl_s=getattr(args, "ttl_s", None),
+                        uses=getattr(args, "uses", None),
+                        granted_by="cli", policy=policy)
+    except ValueError as exc:
+        print(f"  Error: {exc}")
+        return
+
+    print_header("Override granted")
+    print(f"  Id      : {grant['id']}")
+    print(f"  Allows  : {tool} {op} on {grant['path_key']}")
+    print(f"  Layer   : {gate}   Rule: {rule}")
+    print(f"  Session : {grant['session_id']}")
+    print(f"  Expires : {grant['expires_at']}   Uses: "
+          f"{grant['uses_remaining']}")
+    if getattr(args, "ttl_s", None) and grant.get("expires_at"):
+        print(f"  (TTL clamped to override.max_ttl_s = {policy.max_ttl_s}s "
+              f"where it exceeded it)")
+    print(f"\n  The rule {rule} is still in force. This grant authorises one "
+          "retry of")
+    print("  this exact call, in this session, on this exact path, and "
+          "nothing else.")
+    _override_audit(grant, project_path)
+
+
+def _override_list(args, project_path: str, og) -> None:
+    grants = og.active(project_path, getattr(args, "session_id", "") or "")
+    print_header("Live override grants")
+    if not grants:
+        print("  (none)")
+    for g in grants:
+        print(f"  {g.get('id', '?'):18s} {g.get('tool', '?')} "
+              f"{g.get('op', '?')} {g.get('path_key', '?')}")
+        print(f"  {'':18s} rule {g.get('rule', '?')} · session "
+              f"{g.get('session_id', '?')} · expires {g.get('expires_at', '?')}"
+              f" · {g.get('uses_remaining', 0)} use(s) left")
+    tail = int(getattr(args, "audit", 0) or 0)
+    if tail:
+        print("\n  Audit (.c3/overrides.jsonl):")
+        for line in og.read_audit(project_path, tail):
+            print(f"    {line.get('ts', '?')}  {line.get('event', '?'):12s} "
+                  f"{line.get('grant_id', '')} {line.get('path', '')}")
+
+
+def _override_check(args, policy, project_path: str, og, opol) -> None:
+    gate, layer_key, rule, tool, op, err = _override_identify(
+        args, project_path, opol)
+    if err:
+        print(f"  {err}")
+        return
+    if not policy.escalatable(layer_key):
+        print(f"  Denied — the '{layer_key}' layer is not escalatable, so no "
+              "grant is even consulted.")
+        return
+    hit = og.find(project_path, session_id=getattr(args, "session_id", ""),
+                  layer=gate, rule=rule, tool=tool, op=op,
+                  path=getattr(args, "target", ""))
+    if hit:
+        print(f"  Allowed by {hit['id']} — {hit['uses_remaining']} use(s) "
+              f"left, expires {hit['expires_at']}.")
+        print("  (`check` never consumes a use.)")
+    else:
+        print("  Denied — no live grant matches this exact "
+              "session/layer/rule/tool/op/path.")
+
+
+def _override_audit(grant: dict, project_path: str) -> None:
+    """Ledger + activity entry. The JSONL audit is written by the service."""
+    try:
+        from services.activity_log import ActivityLog
+        ActivityLog(project_path).log("access_action", {
+            "kind": "override", "action": "grant", "grant_id": grant["id"],
+            "layer": grant["layer"], "rule": grant["rule"],
+            "tool": grant["tool"], "op": grant["op"],
+            "path": grant["path_key"], "session_id": grant["session_id"],
+            "expires_at": grant["expires_at"],
+            "uses": grant["uses_remaining"], "granted_by": grant["granted_by"],
+        })
+    except Exception:
+        pass
+    try:
+        from services.edit_ledger import EditLedger
+        EditLedger(project_path).log_edit(
+            file=f"override://{grant['id']}",
+            change_type="override_grant",
+            summary=(f"granted {grant['tool']} {grant['op']} on "
+                     f"{grant['path_key']} once (rule {grant['rule']}, "
+                     f"expires {grant['expires_at']}) via `c3 override`"),
+            tags=["override", "access"],
+            detail={"kind": "override", **grant},
+        )
+    except Exception:
+        pass
+
+
 def cmd_access(args):
     """Access Guard rule management — human-only mutation surface (spec §1)."""
     sub = getattr(args, "access_cmd", None)
@@ -7994,6 +8288,7 @@ def main():
         "creds": cmd_creds,
         "access": cmd_access,
         "enforce": cmd_enforce,
+        "override": cmd_override,
         "locks": cmd_locks,
         "oracle": cmd_oracle,
         "upgrade": cmd_upgrade,

{code_context_control-2.67.0 → code_context_control-2.71.0}/cli/commands/parser.py

@@ -472,6 +472,108 @@ def build_parser(version: str, parse_cli_ide_arg):
     lk_sweep = locks_subs.add_parser("sweep", help="Drop expired leases now")
     lk_sweep.add_argument("--path", dest="project_path", default=".")
 
+    # ── Override Requests (v2.69.0, docs/override-requests.md) ──────────
+    # Human-only approval surface. A grant is single-use, session-bound,
+    # path-exact and TTL-capped, and it never edits policy: the rule that
+    # denied the call is still in force the moment the grant is spent.
+    # There is no agent-facing path to any verb in this command.
+    p_override = subparsers.add_parser(
+        "override",
+        help="Override Requests — allow one blocked call once, without weakening the rule",
+    )
+    override_subs = p_override.add_subparsers(dest="override_cmd")
+
+    ov_policy = override_subs.add_parser(
+        "policy", help="Show the effective `override` policy and which layers are escalatable"
+    )
+    ov_policy.add_argument("--path", dest="project_path", default=".",
+                           help="Project directory (default: current)")
+
+    ov_grant = override_subs.add_parser(
+        "grant", help="Mint a single-use grant for one blocked call (human approval)"
+    )
+    ov_grant.add_argument("target", help="The exact path that was blocked")
+    ov_grant.add_argument("--session", dest="session_id", required=True,
+                          help="Claude Code session id the grant is bound to — a grant never crosses sessions")
+    ov_grant.add_argument("--op", choices=["read", "write"], default="read",
+                          help="Operation to allow (default: read)")
+    ov_grant.add_argument("--tool", default=None,
+                          help="Exact tool name (default: Read for --op read, Edit for --op write)")
+    ov_grant.add_argument("--layer", choices=["access", "discipline", "mask", "shell"],
+                          default=None,
+                          help="Force a layer. Default: derive it from the denial the path actually produces")
+    ov_grant.add_argument("--ttl", type=int, default=None, dest="ttl_s",
+                          help="Seconds until the grant expires (clamped to override.max_ttl_s, hard ceiling 900)")
+    ov_grant.add_argument("--uses", type=int, default=None,
+                          help="Uses allowed (default 1; >1 needs override.allow_session_grants)")
+    ov_grant.add_argument("--confirm", default=None,
+                          help="Required for deny/builtin rules: retype the rule glob by hand")
+    ov_grant.add_argument("--path", dest="project_path", default=".",
+                          help="Project directory (default: current)")
+
+    ov_list = override_subs.add_parser("list", help="Live grants for this project")
+    ov_list.add_argument("--session", dest="session_id", default="",
+                         help="Only grants bound to this session id")
+    ov_list.add_argument("--audit", type=int, default=0, metavar="N",
+                         help="Also print the last N lines of .c3/overrides.jsonl")
+    ov_list.add_argument("--path", dest="project_path", default=".",
+                         help="Project directory (default: current)")
+
+    ov_revoke = override_subs.add_parser("revoke", help="Drop a live grant before it is used")
+    ov_revoke.add_argument("grant_id", help="Grant id (grt_…)")
+    ov_revoke.add_argument("--path", dest="project_path", default=".",
+                           help="Project directory (default: current)")
+
+    ov_check = override_subs.add_parser(
+        "check", help="Would a grant cover this call right now? (never consumes one)"
+    )
+    ov_check.add_argument("target", help="Path to test")
+    ov_check.add_argument("--session", dest="session_id", required=True)
+    ov_check.add_argument("--op", choices=["read", "write"], default="read")
+    ov_check.add_argument("--tool", default=None)
+    ov_check.add_argument("--layer", choices=["access", "discipline", "mask", "shell"],
+                          default=None)
+    ov_check.add_argument("--path", dest="project_path", default=".",
+                          help="Project directory (default: current)")
+
+    ov_sweep = override_subs.add_parser("sweep", help="Drop expired / spent grants now")
+    ov_sweep.add_argument("--path", dest="project_path", default=".",
+                          help="Project directory (default: current)")
+
+    # Requests: what agents have ASKED for. Deciding is human-only and lives
+    # here (and, later, on the phone) — never on the c3_override agent tool.
+    ov_requests = override_subs.add_parser(
+        "requests", help="Override requests agents have asked for"
+    )
+    ov_requests.add_argument("--status", default="",
+                             help="pending | approved | denied | expired | withdrawn")
+    ov_requests.add_argument("--all", dest="all_projects", action="store_true",
+                             help="Every project, not just this one")
+    ov_requests.add_argument("--path", dest="project_path", default=".",
+                             help="Project directory (default: current)")
+
+    ov_approve = override_subs.add_parser(
+        "approve", help="Approve one request — mints a single-use grant"
+    )
+    ov_approve.add_argument("request_id", help="Request id (ovr_…)")
+    ov_approve.add_argument("--ttl", type=int, default=None, dest="ttl_s",
+                            help="Seconds until the grant expires (clamped to override.max_ttl_s)")
+    ov_approve.add_argument("--uses", type=int, default=None,
+                            help="Uses allowed (default 1)")
+    ov_approve.add_argument("--note", default="",
+                            help="Note recorded with the decision")
+    ov_approve.add_argument("--confirm", default=None,
+                            help="Required for deny/builtin rules: retype the rule glob by hand")
+    ov_approve.add_argument("--path", dest="project_path", default=".",
+                            help="Project directory (default: current)")
+
+    ov_deny = override_subs.add_parser("deny", help="Refuse one request")
+    ov_deny.add_argument("request_id", help="Request id (ovr_…)")
+    ov_deny.add_argument("--note", default="",
+                         help="Note the agent will see with the refusal")
+    ov_deny.add_argument("--path", dest="project_path", default=".",
+                         help="Project directory (default: current)")
+
     # ── Tool discipline / enforcement mode (v2.66.0) ────────────────────
     # LAYER C: how hard C3 pushes the agent toward c3_* tools. Distinct from
     # `c3 access` (path policy — a security boundary) and from

{code_context_control-2.67.0 → code_context_control-2.71.0}/cli/hook_access_guard.py

@@ -81,6 +81,22 @@ def _record(denial, tool: str, operation: str, path: str,
         pass
 
 
+def _override_allows(base: str, denial, *, tool: str, op: str, path: str,
+                     session_id: str):
+    """A live override grant covering this exact call, or None (spec §5).
+
+    Lazy import and policy-before-grants ordering keep the hot path free: a
+    project that never turned overrides on pays one dict lookup and never
+    opens the grants file. Any failure returns None — the denial stands.
+    """
+    try:
+        from services import override_grants as og  # noqa: PLC0415 — lazy
+        return og.gate_access(base, denial, tool=tool, op=op, path=path,
+                              session_id=session_id)
+    except Exception:
+        return None  # fail closed: no grant, ordinary denial
+
+
 def _target(tool_input: dict) -> str:
     return str(
         tool_input.get("file_path")
@@ -136,6 +152,10 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
         op = "write" if tool in _WRITE_TOOLS else "read"
         denial = ag.check(fp, op, base)
         if denial:
+            granted = _override_allows(base, denial, tool=tool, op=op,
+                                       path=fp, session_id=session_id)
+            if granted:
+                return {"additionalContext": granted}
             _record(denial, tool, op, fp, base, session_id)
             return _deny(ag.refusal(denial, fp, op, surface="hook", tool=tool))
         return None

{code_context_control-2.67.0 → code_context_control-2.71.0}/cli/hook_pretool_enforce.py

@@ -360,6 +360,25 @@ def _vault_denial(tool_name: str, tool_input: dict) -> dict | None:
     return None
 
 
+def _override_allows(base: Path, tool_name: str, tool_input: dict,
+                     session_id: str) -> str | None:
+    """A live discipline grant for this exact write, or None (spec §5).
+
+    Runs AFTER `_vault_denial`, which stays unconditional: no grant, no
+    config value and no approval can open a native write path to the vault.
+    """
+    target = str(tool_input.get("file_path")
+                 or tool_input.get("notebook_path") or "")
+    if not target:
+        return None
+    try:
+        from services import override_grants as og  # noqa: PLC0415 — lazy
+        return og.gate_discipline(base, tool=tool_name, path=target,
+                                  session_id=session_id)
+    except Exception:
+        return None  # fail closed: no grant, ordinary block
+
+
 def run(payload: dict, project_path: Path | None = None) -> dict | None:
     """Core enforcement logic — importable by the dispatcher and tests.
 
@@ -421,6 +440,9 @@ def run(payload: dict, project_path: Path | None = None) -> dict | None:
     # the ledger stays complete either way; what is lost is the pre-edit
     # snapshot c3_edit would have taken.
     if tool_name in blocked_tools and mode == "strict":
+        granted = _override_allows(base, tool_name, tool_input, session_id)
+        if granted:
+            return _with_warnings({"additionalContext": granted}, policy)
         _record_block(tool_name, tool_input, session_id, base)
         reason = (
             f"[c3:enforce] Native `{tool_name}` is blocked to preserve the edit "

{code_context_control-2.67.0 → code_context_control-2.71.0}/cli/hub_server.py

@@ -1780,25 +1780,15 @@ def api_projects_config_get():
 # returned by any hub route (no reveal exists here). `credentials` stays out of
 # _CONFIG_WRITE_SECTIONS — these dedicated routes are the only hub write path.
 
-_CRED_PUBLIC_FIELDS = ("scope", "type", "value_len", "env_var", "inject",
-                       "agent_readable", "description", "storage", "created",
-                       "updated")
-
-
 def _cred_entry_public(name, entry, *, usage=None, shadows_global=None):
-    """Explicit allowlist serializer — structurally cannot emit a value."""
-    rec = {"name": name}
-    for key in _CRED_PUBLIC_FIELDS:
-        rec[key] = entry.get(key, "")
-    rec["value_len"] = entry.get("value_len", 0)
-    rec["inject"] = bool(entry.get("inject"))
-    rec["agent_readable"] = bool(entry.get("agent_readable"))
-    if usage is not None:
-        rec["last_used"] = (usage.get(name) or {}).get("last_used", "")
-        rec["use_count"] = (usage.get(name) or {}).get("use_count", 0)
-    if shadows_global is not None:
-        rec["shadows_global"] = bool(shadows_global)
-    return rec
+    """Explicit allowlist serializer — structurally cannot emit a value.
+
+    Delegates to credential_store.public_entry so the hub, the per-project UI
+    and the mobile gateway all serialize through one allowlist; a second copy
+    is exactly the drift the write-only wire contract cannot survive."""
+    from services import credential_store as cred_store
+    return cred_store.public_entry(
+        name, entry, usage=usage, shadows_global=shadows_global)
 
 
 def _resolve_cred_target(path: str, scope: str, *, mutation: bool):

{code_context_control-2.67.0 → code_context_control-2.71.0}/cli/mcp_server.py

@@ -758,6 +758,30 @@ async def c3_locks(action: str = "list", paths: str = "", intent: str = "",
                                    svc, finalize)
 
 
+@mcp.tool()
+async def c3_override(action: str = "list", path: str = "", tool: str = "",
+                      op: str = "read", why: str = "", request_id: str = "",
+                      layer: str = "", timeout_s: int = 60,
+                      ctx: Context = None) -> str:
+    """ASK A HUMAN to allow ONE blocked call — never a policy change.
+    actions: request, status, wait (blocks <=180s), list, withdraw.
+    request: path = the exact blocked path; why = one concrete sentence for the human.
+    A yes mints a single-use, session-bound, path-exact grant with a short TTL; the
+    rule that blocked you stays in force. There is NO approve action here — only the
+    user can decide, from their phone or `c3 override approve`.
+    Most denials are NOT escalatable (credential vault, Tier-0, catastrophic shell
+    commands); those are refused here and never shown to anyone. If a refusal did not
+    invite you to ask, do not ask — mark the step blocked and tell the user."""
+    svc = _svc(ctx)
+
+    def finalize(name, args, resp, summ, **kw):
+        return _finalize_response(ctx, name, args, resp, summ, **kw)
+
+    from cli.tools.override import handle_override
+    return await asyncio.to_thread(handle_override, action, path, tool, op, why,
+                                   request_id, layer, timeout_s, svc, finalize)
+
+
 @mcp.tool()
 async def c3_impact(target: str, file_path: str = "", mode: str = "symbol",
                     ctx: Context = None) -> str: